@synopackageland/cli 0.5.3 → 0.6.0

package/dist/templates/native-go/backend/internal/helper/readonly_operations_linux.go

@@ -1,168 +0,0 @@
-package helper
-
-import (
-	"context"
-	"crypto/rand"
-	"encoding/hex"
-	"encoding/json"
-	"golang.org/x/sys/unix"
-	"io"
-	"path"
-)
-
-func authorizeReadOnly(ctx context.Context, o *readOnlyObject, w readOnlyWork, acl readOnlyACL) Code {
-	if code := nativeContextCode(ctx); code != "" {
-		return code
-	}
-	if acl == nil {
-		return ErrUnsupported
-	}
-	for _, fd := range []int{int(o.nodes[o.root].file.Fd()), int(o.data.Fd())} {
-		if code := nativeObservationCode(ctx, acl.Authorize(ctx, w.Action, fd)); code != "" {
-			return code
-		}
-	}
-	return o.check()
-}
-func readOnlyUnchanged(fd int, before unix.Stat_t) Code {
-	var after unix.Stat_t
-	if code := readOnlyInspect(fd, &after); code != "" {
-		return code
-	}
-	if !sameReadOnlyObject(before, after) || before.Size != after.Size || before.Mtim != after.Mtim || before.Ctim != after.Ctim {
-		return ErrStale
-	}
-	return ""
-}
-func readOnlyEntry(name string, st unix.Stat_t) (Entry, Code) {
-	var id [32]byte
-	if _, err := rand.Read(id[:]); err != nil {
-		return Entry{}, ErrUnavailable
-	}
-	kind := "regular"
-	size := uint64(st.Size)
-	if st.Mode&unix.S_IFMT == unix.S_IFDIR {
-		kind = "directory"
-		size = 0
-	}
-	return Entry{EntryID: hex.EncodeToString(id[:]), Name: name, Kind: kind, Bytes: size}, ""
-}
-func executeReadOnly(ctx context.Context, pin *pinnedReadOnlyRoot, w readOnlyWork, acl readOnlyACL) (readOnlyResult, []byte) {
-	fail := func(c Code) (readOnlyResult, []byte) { return readOnlyResult{Code: c}, nil }
-	if c := nativeContextCode(ctx); c != "" {
-		return fail(c)
-	}
-	if c := w.validate(); c != "" {
-		return fail(c)
-	}
-	if acl == nil || w.Action == ActionReadStream {
-		return fail(ErrUnsupported)
-	}
-	timeout := MetadataTimeout
-	if w.Action == ActionRead {
-		timeout = BoundedTimeout
-	}
-	ctx, cancel := context.WithTimeout(ctx, timeout)
-	defer cancel()
-	o, c := resolveReadOnly(ctx, pin, w)
-	if c != "" {
-		return fail(c)
-	}
-	defer o.Close()
-	if c = authorizeReadOnly(ctx, o, w, acl); c != "" {
-		return fail(c)
-	}
-	result := readOnlyResult{}
-	var data []byte
-	switch w.Action {
-	case ActionRead:
-		if o.before.Mode&unix.S_IFMT != unix.S_IFREG {
-			return fail(ErrDenied)
-		}
-		if o.before.Size < 0 || uint64(o.before.Size) > w.MaxBytes {
-			return fail(ErrLimit)
-		}
-		var err error
-		data, err = io.ReadAll(io.LimitReader(o.data, int64(w.MaxBytes)+1))
-		if err != nil {
-			return fail(readOnlyError(err))
-		}
-		if uint64(len(data)) > w.MaxBytes {
-			return fail(ErrLimit)
-		}
-		result.Bytes = uint64(len(data))
-	case ActionStat:
-		e, c := readOnlyEntry(path.Base(w.RootPath), o.before)
-		if len(w.Segments) > 0 {
-			e.Name = w.Segments[len(w.Segments)-1]
-		}
-		if c != "" {
-			return fail(c)
-		}
-		result.Entry = &e
-	case ActionList:
-		if o.before.Mode&unix.S_IFMT != unix.S_IFDIR {
-			return fail(ErrDenied)
-		}
-		// No unbound cursor or unbounded sort/scan. Oversized/changed directories
-		// refuse without metadata; pagination is a separate server-bound extension.
-		names, err := o.data.Readdirnames(MaxPageEntries + 1)
-		if err != nil && err != io.EOF {
-			return fail(readOnlyError(err))
-		}
-		if len(names) > MaxPageEntries {
-			return fail(ErrLimit)
-		}
-		entries := []Entry{}
-		for _, name := range names {
-			if c := nativeContextCode(ctx); c != "" {
-				return fail(c)
-			}
-			child := w
-			child.Action = ActionStat
-			child.Limit = 0
-			child.Segments = append(append([]string{}, w.Segments...), name)
-			if child.validate() != "" {
-				continue
-			}
-			object, code := resolveReadOnly(ctx, pin, child)
-			if code == ErrDenied {
-				continue
-			}
-			if code != "" {
-				return fail(code)
-			}
-			code = authorizeReadOnly(ctx, object, w, acl)
-			if code == "" {
-				var entry Entry
-				entry, code = readOnlyEntry(name, object.before)
-				if code == "" {
-					entries = append(entries, entry)
-				}
-			}
-			object.Close()
-			if code == ErrDenied {
-				continue
-			}
-			if code != "" {
-				return fail(code)
-			}
-			if len(entries) > int(w.Limit) {
-				return fail(ErrLimit)
-			}
-		}
-		result.List = &ListResult{Entries: entries}
-	}
-	if c := authorizeReadOnly(ctx, o, w, acl); c != "" {
-		return fail(c)
-	}
-	if c := readOnlyUnchanged(int(o.data.Fd()), o.before); c != "" {
-		return fail(c)
-	}
-	// Metadata travels only over the private seqpacket, bulk read bytes never JSON.
-	b, err := json.Marshal(result)
-	if err != nil || len(b) > MaxControlBytes-2048 {
-		return fail(ErrLimit)
-	}
-	return result, data
-}

package/dist/templates/native-go/backend/internal/helper/readonly_resolver_linux.go

@@ -1,241 +0,0 @@
-package helper
-
-import (
-	"context"
-	"errors"
-	"golang.org/x/sys/unix"
-	"os"
-	"strings"
-)
-
-type pinnedReadOnlyRoot struct {
-	path string
-	file *os.File
-}
-
-func (r *pinnedReadOnlyRoot) readOnlyRootPath() string                        { return r.path }
-func (r *pinnedReadOnlyRoot) sameReadOnlyRoot(other readOnlyRootWitness) bool { return r == other }
-
-func (r *pinnedReadOnlyRoot) Close() error { return r.file.Close() }
-
-type readOnlyNode struct {
-	file  *os.File
-	name  string
-	stat  unix.Stat_t
-	mount uint64
-}
-type readOnlyObject struct {
-	nodes  []readOnlyNode
-	root   int
-	data   *os.File
-	before unix.Stat_t
-}
-
-func (o *readOnlyObject) Close() {
-	if o.data != nil {
-		o.data.Close()
-	}
-	for _, n := range o.nodes {
-		n.file.Close()
-	}
-}
-func readOnlyError(err error) Code {
-	if errors.Is(err, unix.EACCES) || errors.Is(err, unix.EPERM) {
-		return ErrDenied
-	}
-	if errors.Is(err, unix.ENOENT) || errors.Is(err, unix.ENOTDIR) || errors.Is(err, unix.ELOOP) {
-		return ErrStale
-	}
-	return ErrUnavailable
-}
-func readOnlyNodeAt(parent int, name string) (readOnlyNode, Code) {
-	fd, err := unix.Openat(parent, name, unix.O_PATH|unix.O_NOFOLLOW|unix.O_CLOEXEC, 0)
-	if err != nil {
-		return readOnlyNode{}, readOnlyError(err)
-	}
-	n := readOnlyNode{file: os.NewFile(uintptr(fd), "readonly-object"), name: name}
-	code := readOnlyInspect(fd, &n.stat)
-	if code == "" {
-		n.mount, code = readOnlyMountID(fd)
-	}
-	if code != "" {
-		n.file.Close()
-		return readOnlyNode{}, code
-	}
-	// O_PATH alone does not require search permission. Resolve '.' under actor
-	// credentials to require execute/search on every directory, including root.
-	if n.stat.Mode&unix.S_IFMT == unix.S_IFDIR {
-		probe, err := unix.Openat(fd, ".", unix.O_PATH|unix.O_DIRECTORY|unix.O_NOFOLLOW|unix.O_CLOEXEC, 0)
-		if err != nil {
-			n.file.Close()
-			return readOnlyNode{}, readOnlyError(err)
-		}
-		unix.Close(probe)
-	}
-	return n, ""
-}
-func readOnlyInspect(fd int, st *unix.Stat_t) Code {
-	if err := unix.Fstat(fd, st); err != nil {
-		return readOnlyError(err)
-	}
-	switch st.Mode & unix.S_IFMT {
-	case unix.S_IFDIR:
-		return ""
-	case unix.S_IFREG:
-		if st.Nlink != 1 {
-			return ErrDenied
-		}
-		return ""
-	}
-	return ErrDenied // never open a FIFO, device, socket or symlink for data
-}
-func sameReadOnlyObject(a, b unix.Stat_t) bool {
-	return a.Dev == b.Dev && a.Ino == b.Ino && a.Mode&unix.S_IFMT == b.Mode&unix.S_IFMT
-}
-func (o *readOnlyObject) check() Code {
-	for i, n := range o.nodes {
-		var st unix.Stat_t
-		if code := readOnlyInspect(int(n.file.Fd()), &st); code != "" {
-			return code
-		}
-		if !sameReadOnlyObject(st, n.stat) {
-			return ErrStale
-		}
-		if i == 0 {
-			continue
-		}
-		current, code := readOnlyNodeAt(int(o.nodes[i-1].file.Fd()), n.name)
-		if code != "" {
-			return code
-		}
-		match := sameReadOnlyObject(current.stat, n.stat) && current.mount == n.mount
-		current.file.Close()
-		if !match {
-			return ErrStale
-		}
-	}
-	var current unix.Stat_t
-	if code := readOnlyInspect(int(o.data.Fd()), &current); code != "" {
-		return code
-	}
-	target := o.nodes[len(o.nodes)-1]
-	if !sameReadOnlyObject(current, target.stat) {
-		return ErrStale
-	}
-	return ""
-}
-
-// A pin is an O_PATH continuity witness, NOT a root-opened data/ACL capability.
-// It remains live for one approved epoch only; never reconstruct it from inode.
-func pinReadOnlyRoot(path string) (*pinnedReadOnlyRoot, Code) {
-	w := readOnlyWork{RootPath: path, Action: ActionStat, Segments: []string{}}
-	if code := w.validate(); code != "" {
-		return nil, code
-	}
-	slash, code := readOnlyNodeAt(unix.AT_FDCWD, "/")
-	if code != "" {
-		return nil, code
-	}
-	current := slash
-	for _, segment := range strings.Split(path[1:], "/") {
-		next, c := readOnlyNodeAt(int(current.file.Fd()), segment)
-		current.file.Close()
-		if c != "" {
-			return nil, c
-		}
-		current = next
-		if current.stat.Mode&unix.S_IFMT != unix.S_IFDIR {
-			current.file.Close()
-			return nil, ErrDenied
-		}
-	}
-	if code := readOnlyLocalMount(int(current.file.Fd())); code != "" {
-		current.file.Close()
-		return nil, code
-	}
-	return &pinnedReadOnlyRoot{path: path, file: current.file}, ""
-}
-
-// Always uses the 4.4-compatible walk; openat2 is not a dependency. All ancestry
-// FDs stay pinned. No realpath, Clean, pathname ACL-then-open or proc data alias.
-func resolveReadOnly(ctx context.Context, pin *pinnedReadOnlyRoot, w readOnlyWork) (*readOnlyObject, Code) {
-	if code := nativeContextCode(ctx); code != "" {
-		return nil, code
-	}
-	if pin == nil || pin.file == nil || pin.path != w.RootPath {
-		return nil, ErrSuspended
-	}
-	flags, err := unix.FcntlInt(pin.file.Fd(), unix.F_GETFL, 0)
-	if err != nil || flags&unix.O_PATH == 0 {
-		return nil, ErrDenied
-	}
-	var expected unix.Stat_t
-	if unix.Fstat(int(pin.file.Fd()), &expected) != nil || expected.Mode&unix.S_IFMT != unix.S_IFDIR {
-		return nil, ErrSuspended
-	}
-	mount, code := readOnlyMountID(int(pin.file.Fd()))
-	if code != "" {
-		return nil, code
-	}
-	o := &readOnlyObject{}
-	ok := false
-	defer func() {
-		if !ok {
-			o.Close()
-		}
-	}()
-	slash, code := readOnlyNodeAt(unix.AT_FDCWD, "/")
-	if code != "" {
-		return nil, code
-	}
-	o.nodes = append(o.nodes, slash)
-	parts := strings.Split(w.RootPath[1:], "/")
-	o.root = len(parts)
-	parts = append(parts, w.Segments...)
-	for i, segment := range parts {
-		if code := nativeContextCode(ctx); code != "" {
-			return nil, code
-		}
-		parent := o.nodes[len(o.nodes)-1]
-		if parent.stat.Mode&unix.S_IFMT != unix.S_IFDIR {
-			return nil, ErrDenied
-		}
-		next, code := readOnlyNodeAt(int(parent.file.Fd()), segment)
-		if code != "" {
-			return nil, code
-		}
-		o.nodes = append(o.nodes, next)
-		if i+1 >= o.root && (next.mount != mount || next.stat.Dev != expected.Dev) {
-			return nil, ErrSuspended
-		}
-		if i+1 == o.root && !sameReadOnlyObject(next.stat, expected) {
-			return nil, ErrSuspended
-		}
-	}
-	if code := readOnlyLocalMount(int(o.nodes[o.root].file.Fd())); code != "" {
-		return nil, code
-	}
-	target := o.nodes[len(o.nodes)-1]
-	parent := o.nodes[len(o.nodes)-2]
-	// Type-probe precedes nonblocking data open; compare both captured objects.
-	fd, err := unix.Openat(int(parent.file.Fd()), target.name, unix.O_RDONLY|unix.O_NONBLOCK|unix.O_NOFOLLOW|unix.O_CLOEXEC, 0)
-	if err != nil {
-		return nil, readOnlyError(err)
-	}
-	o.data = os.NewFile(uintptr(fd), "readonly-data")
-	if code := readOnlyInspect(fd, &o.before); code != "" {
-		return nil, code
-	}
-	m, code := readOnlyMountID(fd)
-	if code != "" {
-		return nil, code
-	}
-	if !sameReadOnlyObject(o.before, target.stat) || m != mount {
-		return nil, ErrStale
-	}
-	if code := o.check(); code != "" {
-		return nil, code
-	}
-	ok = true
-	return o, ""
-}

package/dist/templates/native-go/backend/internal/helper/readonly_test.go

@@ -1,40 +0,0 @@
-package helper
-
-import "testing"
-
-func TestReadOnlyWorkClosedActionsAndBounds(t *testing.T) {
-	for _, action := range []Action{ActionStat, ActionList, ActionRead} {
-		w := readOnlyWork{RootPath: "/fixture", Action: action, Segments: []string{"file"}}
-		if action == ActionList {
-			w.Limit = 10
-		}
-		if action == ActionRead {
-			w.MaxBytes = MaxBoundedBytes
-		}
-		if c := w.validate(); c != "" {
-			t.Fatal(action, c)
-		}
-		for _, name := range []string{"path", "traverse", "symlink-name", "limit", "action", "extra"} {
-			t.Run(string(action)+name, func(t *testing.T) {
-				bad := w
-				switch name {
-				case "path":
-					bad.RootPath = "relative"
-				case "traverse":
-					bad.Segments = []string{".."}
-				case "symlink-name":
-					bad.Segments = []string{"a/b"}
-				case "limit":
-					bad.MaxBytes = MaxBoundedBytes + 1
-				case "action":
-					bad.Action = ActionCreate
-				case "extra":
-					bad.Limit = MaxPageEntries + 1
-				}
-				if bad.validate() == "" {
-					t.Fatal("invalid work accepted")
-				}
-			})
-		}
-	}
-}

package/dist/templates/native-go/backend/internal/helper/relaxed_identity.go

@@ -1,252 +0,0 @@
-package helper
-
-import (
-	"context"
-	"crypto/sha256"
-	"encoding/hex"
-	"encoding/json"
-	"slices"
-	"strings"
-	"time"
-	"unicode/utf8"
-)
-
-func validRelaxedIdentity(id RelaxedIdentity) bool {
-	return id.UID != 0 && id.Username != "" && len(id.Username) <= MaxSegmentBytes && utf8.ValidString(id.Username) && !strings.ContainsAny(id.Username, "\x00\r\n/\\")
-}
-func relaxedActorIdentity(a NativeActor) RelaxedIdentity {
-	return RelaxedIdentity{a.UID(), a.Username()}
-}
-func relaxedPrincipalIdentity(p Principal) RelaxedIdentity { return RelaxedIdentity{p.UID, p.Username} }
-func relaxedRelated(a, b RelaxedIdentity) bool             { return a.UID == b.UID || a.Username == b.Username }
-func (r *relaxedProvider) resolve(ctx context.Context, c SessionCarriers, now func() time.Time) (NativeActor, Code) {
-	if r == nil || r.authority == nil || now == nil || r.adapters.Sessions == nil || r.adapters.Accounts == nil || r.adapters.Groups == nil || r.adapters.App == nil {
-		return NativeActor{}, ErrUnavailable
-	}
-	ctx, cancel := context.WithTimeout(ctx, NativeProofFreshness)
-	defer cancel()
-	if code := nativeContextCode(ctx); code != "" {
-		return NativeActor{}, code
-	}
-	if c.Cookie == "" {
-		return NativeActor{}, ErrDenied
-	}
-	if c.ClientAddress == "" {
-		return NativeActor{}, ErrUnavailable
-	}
-	s, code := r.adapters.Sessions.ValidateRelaxedSession(ctx, c)
-	if code = nativeObservationCode(ctx, code); code != "" {
-		return NativeActor{}, code
-	}
-	if !validRelaxedIdentity(RelaxedIdentity{UID: 1, Username: s.Username}) {
-		return NativeActor{}, ErrDenied
-	}
-	if !s.CSRFVerified || r.adapters.AppPrivilegeID == "" {
-		return NativeActor{}, ErrUnsupported
-	}
-	if !allReferences(s.SessionRef) {
-		return NativeActor{}, ErrUnavailable
-	}
-	if !nativeFresh(s.CheckedAt, now()) {
-		return NativeActor{}, ErrStale
-	}
-	a, code := r.adapters.Accounts.LookupRelaxedAccount(ctx, s.Username)
-	if code = nativeObservationCode(ctx, code); code != "" {
-		if code == ErrDenied {
-			if cleanup := r.invalidateName(ctx, s.Username); cleanup != "" {
-				return NativeActor{}, cleanup
-			}
-		}
-		return NativeActor{}, code
-	}
-	if !nativeFresh(a.CheckedAt, now()) {
-		return NativeActor{}, ErrStale
-	}
-	if a.Kind != "local" {
-		return NativeActor{}, ErrUnsupported
-	}
-	if a.StateKnown && !a.Exists {
-		if code = r.invalidateName(ctx, s.Username); code != "" {
-			return NativeActor{}, code
-		}
-		return NativeActor{}, ErrDenied
-	}
-	if a.Identity.Username != s.Username {
-		if code = r.invalidateName(ctx, s.Username, a.Identity); code != "" {
-			return NativeActor{}, code
-		}
-		return NativeActor{}, ErrSuspended
-	}
-	if !a.StateKnown || !a.ExpiryKnown || !a.PasswordKnown || !a.PrimaryGIDKnown {
-		return NativeActor{}, ErrUnavailable
-	}
-	if !a.Exists || !a.Enabled || a.Expired || !a.PasswordUsable {
-		if code = r.invalidateName(ctx, s.Username, a.Identity); code != "" {
-			return NativeActor{}, code
-		}
-		return NativeActor{}, ErrDenied
-	}
-	if !validRelaxedIdentity(a.Identity) || a.PrimaryGID == 0 {
-		return NativeActor{}, ErrDenied
-	}
-	g, code := r.adapters.Groups.LookupRelaxedGroups(ctx, a)
-	if code = nativeObservationCode(ctx, code); code != "" {
-		return NativeActor{}, code
-	}
-	if !nativeFresh(g.CheckedAt, now()) {
-		return NativeActor{}, ErrStale
-	}
-	if g.Identity != a.Identity || g.PrimaryGID != a.PrimaryGID {
-		if code = r.invalidate(ctx, []RelaxedIdentity{a.Identity}); code != "" {
-			return NativeActor{}, code
-		}
-		return NativeActor{}, ErrSuspended
-	}
-	if g.Groups == nil || len(g.Groups) > 1024 || !g.Complete || !g.AdminKnown {
-		return NativeActor{}, ErrUnavailable
-	}
-	app, code := r.adapters.App.ValidateRelaxedApp(ctx, c, s, a, r.adapters.AppPrivilegeID)
-	if code = nativeObservationCode(ctx, code); code != "" {
-		if code == ErrDenied {
-			if cleanup := r.invalidate(ctx, []RelaxedIdentity{a.Identity}); cleanup != "" {
-				return NativeActor{}, cleanup
-			}
-		}
-		return NativeActor{}, code
-	}
-	if !nativeFresh(app.CheckedAt, now()) {
-		return NativeActor{}, ErrStale
-	}
-	if app.Identity != a.Identity || app.ClientAddress != c.ClientAddress || app.AppID != r.adapters.AppPrivilegeID || app.SessionRef != s.SessionRef {
-		return NativeActor{}, ErrDenied
-	}
-	if !app.Allowed {
-		// Conservative grant revocation also stops this caller's foreign-shared work.
-		if code = r.invalidate(ctx, []RelaxedIdentity{a.Identity}); code != "" {
-			return NativeActor{}, code
-		}
-		return NativeActor{}, ErrDenied
-	}
-	oldest := s.CheckedAt
-	for _, at := range []time.Time{a.CheckedAt, g.CheckedAt, app.CheckedAt} {
-		if at.Before(oldest) {
-			oldest = at
-		}
-	}
-	if !nativeFresh(oldest, now()) {
-		return NativeActor{}, ErrStale
-	}
-	principal, code := r.principal(ctx, a.Identity)
-	if code != "" {
-		return NativeActor{}, code
-	}
-	if !nativeFresh(oldest, now()) {
-		return NativeActor{}, ErrStale
-	}
-	groups := slices.Clone(g.Groups)
-	slices.Sort(groups)
-	groups = slices.Compact(groups)
-	return NativeActor{relaxed: r, account: LocalAccount{Principal: principal, Username: a.Identity.Username, Enabled: true, UID: a.Identity.UID, GID: a.PrimaryGID, Groups: groups, Admin: g.Admin, CheckedAt: oldest}, sessionRef: s.SessionRef, valid: true}, ""
-}
-func (r *relaxedProvider) principal(ctx context.Context, id RelaxedIdentity) (Principal, Code) {
-	a := r.authority
-	a.mu.Lock()
-	if r.blocked[id] {
-		a.mu.Unlock()
-		return Principal{}, ErrCleanupRequired
-	}
-	mismatches := map[RelaxedIdentity]bool{}
-	code := a.transaction(func(s *GrantStore) (bool, Code) {
-		for _, g := range s.Grants {
-			if g.State == GrantRevoked {
-				continue
-			}
-			for _, p := range []Principal{g.Owner, g.Issuer} {
-				if p.IdentityBasis != "uid-username" {
-					continue
-				}
-				before := relaxedPrincipalIdentity(p)
-				if before != id && relaxedRelated(before, id) {
-					mismatches[before] = true
-				}
-			}
-		}
-		return false, ""
-	})
-	if code != "" {
-		a.mu.Unlock()
-		return Principal{}, code
-	}
-	if len(mismatches) > 0 {
-		// Block the prospective identity too until every old grant has Q.
-		ids := make([]RelaxedIdentity, 0, len(mismatches))
-		for key := range mismatches {
-			ids = append(ids, key)
-		}
-		if code = r.invalidateLocked(ctx, ids, id); code != "" {
-			return Principal{}, code
-		}
-		return Principal{}, ErrSuspended
-	}
-	defer a.mu.Unlock()
-	if p, ok := r.principals[id]; ok {
-		return p, ""
-	}
-	if len(r.principals) >= MaxReplayEntries {
-		return Principal{}, ErrBusy
-	}
-	ref, code := randomGrantID()
-	if code != "" {
-		return Principal{}, code
-	}
-	// The digest is an index, never a session or birth proof. InstanceRef is a
-	// per-owner random generation rotated on observed invalidation/restart.
-	b, _ := json.Marshal(struct {
-		Basis    string
-		Identity RelaxedIdentity
-	}{"uid-username", id})
-	sum := sha256.Sum256(b)
-	p := Principal{Kind: "local", SubjectRef: hex.EncodeToString(sum[:]), InstanceRef: ref, IdentityBasis: "uid-username", UID: id.UID, Username: id.Username}
-	r.principals[id] = p
-	return p, ""
-}
-func (r *relaxedProvider) revalidate(ctx context.Context, c SessionCarriers, old NativeActor, now func() time.Time) (NativeActor, Code) {
-	if old.relaxed != r || old.managed != nil {
-		return NativeActor{}, ErrSuspended
-	}
-	current, code := r.resolve(ctx, c, now)
-	if code != "" {
-		return NativeActor{}, code
-	}
-	if relaxedActorIdentity(old) != relaxedActorIdentity(current) {
-		r.authority.mu.Lock()
-		if code = r.invalidateLocked(ctx, []RelaxedIdentity{relaxedActorIdentity(old)}, relaxedActorIdentity(current)); code != "" {
-			return NativeActor{}, code
-		}
-		return NativeActor{}, ErrSuspended
-	}
-	if old.Principal() != current.Principal() {
-		return NativeActor{}, ErrSuspended
-	}
-	if old.GID() != current.GID() || old.Admin() != current.Admin() || old.SessionRef() != current.SessionRef() || !slices.Equal(old.Groups(), current.Groups()) {
-		return NativeActor{}, ErrStale
-	}
-	return current, ""
-}
-func (a *GrantAuthority) relaxedActorLocked(actor NativeActor) Code {
-	if actor.relaxed == nil {
-		if a.native != nil && a.native.relaxed != nil {
-			return ErrDenied
-		}
-		return ""
-	}
-	if a.native == nil || a.native.relaxed != actor.relaxed || actor.managed != nil {
-		return ErrDenied
-	}
-	r := actor.relaxed
-	id := relaxedActorIdentity(actor)
-	if r.blocked[id] || r.principals[id] != actor.Principal() {
-		return ErrSuspended
-	}
-	return ""
-}